sanitize-xml-string